메뉴
OpenClaw 技能自动化审计器 Pro（安全/性能/质量三维度 38 条规则）。基于 spclaudehome v1.0.0 fork 深度升级，新增 JSON 报告、CI 退出码、豁免机制、severity-cap 引擎适配。安装第三方技能前必跑。触发词：vet skill, audit skill, 安全审计, 扫描 skill, skill 检查.
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/sujian666666com-glitch/kk-skill --skill lz-skill-vetter-plus명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
Discover and filter 15,330 The Graph subgraphs by domain, network, protocol type, or natural language goal. Each result includes an x402 query URL — $0.01 USDC on Base per call, no API key required.
Audit and reduce AI agent runtime spend in dollars. Use for AI costs, agent spend, token waste, runtime attribution, detector coverage, and FinOps. Works with OpenClaw, Hermes, QM, Claude Code, Cursor, and generic event ingest.
Use this skill whenever the user is troubleshooting a VMware/vSphere problem — a reported error, an exception, a log dump, a slow or failed VM, a host that went sideways — and needs help locating the root cause. It is the diagnostic brain of the VMware family: it drives a systematic investigation, pulls the right signals from the other skills, correlates events into one timeline, ranks root-cause hypotheses, and tells you what to check next even when you don't know where to start. Always use this skill for "diagnose this VMware issue", "why is my VM slow", "troubleshoot this vSphere error", "what does this log mean", "help me figure out what broke" when the context is explicitly VMware/vSphere/ESXi/NSX. It is READ-ONLY: it never changes anything. Do NOT use it to execute fixes — single fixes go to vmware-aiops, multi-step gated remediation goes to vmware-pilot. Do NOT use it for routine inventory or health checks with no problem to solve — use vmware-monitor.
SKILL.md 표시 중
| name | lz-skill-vetter-plus |
| version | 2.1.3 |
| description | OpenClaw 技能自动化审计器 Pro（安全/性能/质量三维度 38 条规则）。基于 spclaudehome v1.0.0 fork 深度升级，新增 JSON 报告、CI 退出码、豁免机制、severity-cap 引擎适配。安装第三方技能前必跑。触发词：vet skill, audit skill, 安全审计, 扫描 skill, skill 检查. |
| allowed-tools | ["exec","read"] |
基于 skill-vetter（spclaudehome v1.0.0）的深度升级版。
原作者授权协议下 fork，38 条自动化规则 + 3 层豁免 + CI 集成 + 引擎类技能适配。
自动化 + 人工审计并行的 OpenClaw 技能安全审计器。
# 1. 文本报告（人类可读）
python3 scripts/audit.py /path/to/skill
# 2. JSON 报告（机器可消费 + CI）
python3 scripts/audit.py /path/to/skill --format json
# 3. 仅看严重问题
python3 scripts/audit.py /path/to/skill --severity high
# 4. CI 退出码模式
python3 scripts/audit.py /path/to/skill --exit-code
# 退出码：0=pass, 1=warning, 2=fail
| 维度 | v1.0.0 | v2.0.0 | v2.0.1 | v2.1.x |
|---|---|---|---|---|
| 安全扫描 | 人工 4 步协议 | ✅ 自动化 24 条 | ✅ +3 误判豁免 | ✅ + safe-pattern 双层校验 |
| 性能审计 | ❌ | ✅ 5 条 | ✅ | ✅ |
| 质量审计 | ❌ | ✅ 9 条 | ✅ | ✅ |
| JSON 报告 | ❌ | ✅ | ✅ | ✅ |
| CI 集成 | ❌ | ✅ --exit-code | ✅ + batch_audit.sh | ✅ |
| 豁免机制 | ❌ | ✅ # safe-pattern: 注释 | ✅ + markdown 表格/标题智能豁免 | ✅ reason 白名单 + 文件级 manifest（v2.1.2） |
| 模式库 | 内置硬编码 | ✅ YAML 可扩展 | ✅ + 3 个误判修复 | ✅ + 1 修复（dot-key 词边界） |
| 人工审计 | ✅ 4 步协议 | ✅ 保留在 references/audit_protocol.md | ✅ | ✅ |
合计 38 条 自动审计规则。
| 问题 | v2.0.0 | v2.0.1 |
|---|---|---|
1password op:// 引用误判 | critical | ✅ exception_pattern 豁免 |
| Chrome/123.0.0.0 版本号误判为 IP | high | ** 正则加 (?<![\w./])...(?!\w.) 边界 |
| 工具类 updater 用 curl/wget | high | ✅ severity 降为 medium |
完整协议见 references/audit_protocol.md。
| 命中 | verdict |
|---|---|
| ≥1 critical | ⛔ ❌ DO NOT INSTALL |
| ≥1 high | 🔴 ⚠️ INSTALL WITH CAUTION |
| ≥1 medium | 🟡 ⚠️ REVIEW MEDIUM ISSUES |
| ≥1 low/info | 🟢 ✅ SAFE TO INSTALL (minor notes) |
| 无任何命中 | 🟢 ✅ SAFE TO INSTALL |
scripts/scan.sh /path/to/skill
# 自动调 audit.py；若无 PyYAML 则用 grep fallback
# safe-pattern: 注释（双层校验 · v2.1.2）任意一行带 # safe-pattern: <reason>（Python/Shell）或 <!-- safe-pattern: <reason> -->（Markdown）即意图豁免。v2.1.2 起双层校验：
documentation / rule-description / version-history / doc-example / test-fixture 之一。无 reason 或 reason 未知 → 不豁免。.safe-pattern-manifest.json 的 exemptions 数组且 reason 匹配 → 才豁免。未提供 manifest 的技能 = 任何 safe-pattern 都不豁免（默认严格，防御「按内容豁免」攻击面）。# 这是文档示例，展示 setuid 用法（实际未启用） # safe-pattern: doc-example
os.setuid(0)
exception_pattern（模式定义层）模式库的 exception_pattern 字段提供正则豁免，例：
- id: SEC-CRED-001
regex: '(?i)(api_key|token)\s*[:=]\s*["\'][^"\']{16,}["\']'
exception_pattern: '\$\{?[A-Z_]+\}?' # 跳过环境变量引用
audit.py 自动跳过：
scripts/patterns/（模式定义自身）scripts/audit.py（审计器自身）references/_*.md（下划线前缀的内部文档，包含 scanner 自身的规则说明——防御「规则描述误报」）.safe-pattern-manifest.json（v2.1.2 新增 · 推荐）需主动豁免的技能应在根目录创建此清单：
{
"version": 1,
"exemptions": [
{
"file": "scripts/run.py",
"reason": "rule-description",
"lines": "10-20",
"note": "scanner 自身的规则定义"
}
]
}
Scanner 仅在 manifest 列出的文件中识别 safe-pattern 注释。未创建 manifest = 默认严格（不豁免任何 safe-pattern）。这是 v2.1.2 防御「safe-pattern 按内容豁免」攻击面的核心。
# .github/workflows/skill-audit.yml
name: Skill Audit
on: [push, pull_request]
jobs:
audit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
with: {python-version: '3.12'}
- run: pip install pyyaml
- name: Audit
run: python3 lz-skill-vetter-plus/scripts/audit.py . --exit-code
references/audit_protocol.md — 4 步人工审计协议references/patterns.md — 38 条模式库索引references/output_format.md — JSON Schema + CI 集成MIT License — Copyright (c) 2026 左运来
severity-cap: low → 原 verdict = SAFE → 现 verdict = ❌ DO NOT INSTALL + 警告横幅显示 capped/uncapped 双值references/_rules_documentation.md 从扫描范围排除（路径 references/_*.md 默认跳过）safe-pattern 必须 reason 字段，reason 必须在白名单（5 类）.safe-pattern-manifest.json 机制，未提供 = 默认严格（不豁免任何 safe-pattern），攻击面消除op:// vault:// secret:// keychain://(?<![\w./])...(?!\w.)，豁免 Chrome/版本号Paranoia is a feature. 🔒🦀